3COM 3591 US 



17 



CLAIMS 



1. A method for detection of server-like devices within a network, said detection 
method comprising the steps of 

determining the ingress to egress network traffic ratio for at least some of the 
devices, 



and selecting the server-like devices on the basis of said determined ratios or a 
10 figure derived from said determined ratios. 



2. A method as claimed in claim 1 in which each server-like device is connected 
to a port of another device and the ingress to egress network traffic ratio is 
determined by determining the network traffic through said port. 

15 

3. A method as claimed in claim 2 in which said network traffic through said port 
is determined using SNMP. 



4. A method as claimed in claim 1 in which the step of selecting the server-like 
20 devices includes selecting those devices having a value of said determined 

ratio above a selected value. 



5. A method as claimed in claim 4 including the step of ranking the devices in 
order of their determined ratios. 

25 

6. A method as claimed in claim 5 in which the selection of the server-like 
devices includes determining discontinuities in the values of the determined 
ratios of the ranked devices. 
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7. 



A method as claimed in claim 5 including the step of nominally plotting the 
determined ratios of the devices against the ranked devices and deriving the 
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second derivative of the graph, and using the second derivative to select the 
server-like devices. 

8. A method as claimed in claim 6 including the step of nominally plotting the 
5 determined ratios of the devices against the ranked devices and deriving the 

third derivative of the graph, and using the second and third derivatives to 
select the server-like devices. 

9. A method as claimed in claim 8 including the step of using the second and 
10 third derivatives to divide the devices into groups and selecting one or more of 

the groups of devices as server-like devices. 

10. A method as claimed in claim 9 in which devices are divided into groups by 
determining the boundaries of the groups as points where the second 

1 5 derivative is zero and the third derivative is less than zero. 

1 1. A method as claimed in claim 10 in which the step of selecting one or more of 
the groups of devices as server-like devices comprises selecting one of said 
points as a cut-off point beyond which all devices are considered as exhibiting 

20 server-like behaviour. 

12. A computer program on a computer readable medium loadable into a digital 
computer, or embodied in a carrier wave, said computer program comprising 
software for performing the steps of claim 1. 

25 

13. A computer program on a computer readable medium loadable into a 
digital computer, or embodied in a carrier wave, said computer program 
comprising the following steps; 

program step 100; Start 
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program step 101; Retrieve iflnOctets and ifOutOctets counter values from all 
devices by interrogating the agents of managed devices and determining traffic data 
from ports connected to those devices 

5 program step 102; Is this the first iteration? If no, go to program step 103. If yes, 

go to program step 104. 

program step 103; Use stored iflnOctets and ifOutOctets values from previous 
iterations to calculate iflnOctets and ifOutOctets delta values for this sample period 
10 and store these. 

program step 104; Store current iflnOctets and ifOutOctets values for all devices. 

program step 105; Are there more sampling periods? If yes, return to program step 
15 101. If no, go to program step 106. 

program step 106; Calculate mean iflnOctets and ifOutOctets values for each 

device, averaging across all sampling periods and store. 

program step 107; Sort results into ascending order and calculate 2 nd and 3 rd 

20 derivative values. 

program step 108; Store all points where second derivative is zero and third 
derivative is less than zero. 

program step 109; Were any points found? If no, go to program step 110. If yes, 
25 go to program step 111. 

program step 110; Use a sensitivity setting to determine which devices to regard 
as exhibiting server-like behaviour and go to program step 1 12. 
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program step 111; Use a sensitivity setting to determine which of the points to use 
as a cut-off point, regard all devices in the ordered ratio graph beyond this point as 
exhibiting server-like behaviour , and go to program step 1 12. 
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program step 1 12; End 

14. Network apparatus for detection of server-like devices within a network, said 
5 apparatus comprising means for determining the ingress to egress network 

traffic ratio for at least some of the devices, and means for selecting the 
server-like devices on the basis of said determined ratios or a figure derived 
from said determined ratios. 

10 15- Apparatus as claimed in claim 14 in which each server-like device is 

connected to a port of another device and the ingress to egress network traffic 
ratio is determined by detennining the network traffic through said port. 

16. Apparatus as claimed in claim 15 in which said network traffic through said 
15 port is determined using SNMP. 

17. Apparatus as claimed in claim 14 including means for selecting those devices 
having a value of said determined ratio above a selected value. 

20 18. Apparatus as claimed in claim 17 means for ranking the devices in order of 

their determined ratios. 

19. Apparatus as claimed in claim 18 including means for detennining 
discontinuities in the values of the determined ratios of the ranked devices. 

25 

20. Apparatus as claimed in claim 18 including means for nominally plotting the 
determined ratios of the devices against the ranked devices and deriving the 
second derivative of the graph, and means for using the second derivative to 
select the server-like devices. 
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21. Apparatus as claimed in claim 19 including means for nominally plotting the 
determined ratios of the devices against the ranked devices and deriving the 
third derivative of the graph, and means for using the second and third 
derivatives to select the server-like devices. 

22. Apparatus as claimed in claim 21 including means for using the second and 
third derivatives to divide the devices into groups and selecting one or more of 
the groups of devices as server-like devices. 

23. Apparatus as claimed in claim 22 including means for dividing the devices 
into groups by determining the boundaries of the groups as points where the 
second derivative is zero and the third derivative is less than zero. 

24. Apparatus as claimed in claim 23 including means for selecting one or more of 
the groups of devices as server-like devices by selecting one of said points as a 
cut-off point beyond which all devices are considered as exhibiting server-like 
behaviour. 



